Why would Wireshark capture only larger sized udp packets?

asked 2018-08-14 18:23:36 +0000

LLTSOL gravatar image

updated 2018-08-15 04:47:53 +0000

Jaap gravatar image

The non captured packets are definitely getting to their destination and heartbeat packages with a size of 176 bytes are being captured by Wireshark. This is happening on a machine with Windows10 and on another machine with Windows Vista. I know that these machines used to capture the smaller 68 byte size packages and no capture or display filters are set. Capturing is done with promiscuous mode turned on. Could it be something that WINpcap version 4.1.3 is doing? Or Wireshark v2.6.2?

edit retag flag offensive close merge delete

Comments

This happens with anti-virus and firewalls turned off.

LLTSOL gravatar imageLLTSOL ( 2018-08-14 18:25:49 +0000 )edit

See what replacing WinPcap with NPcap does on the Windows 10 machine.

Jaap gravatar imageJaap ( 2018-08-15 04:48:39 +0000 )edit

Using NPcap did not resolvle the issue.

LLTSOL gravatar imageLLTSOL ( 2018-08-15 13:47:48 +0000 )edit

So this is not a capture engine issue. What else changed in the mean time? You might even want to try and go back to the Wireshark version that did work.

Jaap gravatar imageJaap ( 2018-08-15 15:51:10 +0000 )edit
add a comment